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REMARKS 

The Examiner rejected claim 1 under 35 U.S.C. §103(a) as allegedly being unpatentable 
over Shcrer (U.S. Patent No. 6,1 15,376) in view or Frantz (U.S. Patent No. 6,697,943). 

The Examiner rejected claims 2-9 under 35 U.S.C. § 103(a) as allegedly being 
unpatentable over Sherer (U.S. Patent No. 6,1 1 5,376) in view of Stem (U.S. Patent No. 
5,935,249) and further in view of Frantz (U.S. Patent No. 6,697,943). 

The Examiner did not provide any grounds for rejecting claims 10-12. Therefore, 
Applicants respectfully request that the Examiner either provide grounds for rejecting claims 10- 
1 2 or else indicate that claims 10-12 arc allowable. 

Applicants respcctlullytraver.se the §103 rejections with the following arguments. 
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as U.S.C. 810 3 

The Examiner rejected claims 1 under 35 U.S.C. §103(a) as allegedly being unpatentable 
Sherer (U.S. Patent No. 6, 1 15,376) in view of Frantz (U.S. Patent No. 6,697,943). 



over ; 



CJajinsJ. 

Applicants respectfully contend that claim 1 is not unpatentable over Shcrcr in view of 
Franlz, because Sherer in view of Frantz does not teach or suggest each and every feature of 
elaim 1 . For example, Sherer in view of Frantz does not teach or suggest the feature: "detecting 
a communication protocol violation consequent to the message, wherein the comxminication 
protocol violation is indicative of a denial of service attack on a target by a spoofing vandal 
using an identity of the network-addressable device" (emphasis added). 

Based on the preceding arguments, Applicants respectfully maintain that claim 1 isnot 
unpatentable over Sherer in view of Frantz, and that claim 1 is in condition for allowance. 

Cla ims 2^9_ 

The Examiner rejected claims 2-9 under 35 U.S.C. §103(a) as allegedly being 
unpatentable over Sherer (U.S. Patent No. 6,1 1 5,376) in view of Stem (U.S. Patent No. 
5,935,249) and further in view of Frantz (U.S. Patent No. 6,697,943). 

With regard to claim 2, Applicants respectfully contend that claim 2 is not unpatentable 
over Sherer in view of Stern and further in view of Frantz. 

A first reason why claim 2 is not unpatentable over Sherer in view of Stem and further in 
09/849,697 7 
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view of Frantz is that Shcrcr in view of Stern and further in view of Frantz docs not teach or 
suggest the feature: "receiving a message by the network-addressable device; [and] detecting a 
communication protocol violation consequent to the message, wherein the communication 
protocol violation is indicative of activity of a spooling vandal using the identity of the network- 
addressable device in an attack on a target" (emphasis added). 

The Examiner argues: "the limitation "receiving a message by the network-addressable 
device" is met by a packet (102 In Fig4.), which is transmitted to interconnection device (100)." 

In response, Applicant note that the Examiner has identified the interconnection device 
100 of Sherer as allegedly representing the network-addressable device of claim 2. Therefore, 
antecedent basis considerations in the preceding feature of claim 2 require a disclosure by Sherer 
that the communication protocol violation is indicative of activity of a spoofing vandal using the 
identity of the interconnection device 100 in an attack on a target. Applicants contend that 
Sherer does not disclose that the communication protocol violation is indicative of activity of a 
spoofing vandal using the identity of the interconnection device 100 in an attack on a target, as 
required by the Examiner's argument. Therefore, claim 2 is not unpatentable over Sherer in 
view of Stem and further in view of Frantz. 

A second reason why claim 2 is not unpatentable over Sherer in view of Stem and further 
in view of Frantz is that Sherer in view of Stem and further in view of Frantz docs not teach or 
suggest the feature: "advancing the value of a counter associated with the target". Although the 
Examiner alleges that Stem teaches a counter for storing a counter vahie, the Examiner does not 
allege that Stern teaches "advancing the counter" as required by claim 2. Indeed, rather than 

09/849,697 8 
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teaching "advancing the counter", Stem teaches (he very opposite, namely "decrementing" the 
counter. See Stern, col. 16, line 36. Therefore, claim 2 is not unpatentable over Sherer in view 
of Stem and further in view of Frantz. 

A third reason why claim 2 is not unpatentable over Sherer in view of Stern and further in 
view of Frantz is that Sherer in view of Stem and farther in view of Front, does not teaeh or 
suggest the feature: "generating a spoofing alert when the value of the counter exceeds the 
threshold". Indeed, none of the references cited by the Examiner teach the preceding future of 
claim 2. Therefore, claim 2 is not unpatentable over Sherer in view of Stem and further in view 
of Frantz. 

A fourth reason why claim 2 is not unpatentable over Sherer in view of Stem and further 
in view of Frantz is that the Examiner's arguments for modifying Sherer by the alleged teaching 

of S tern and Franz is not persuasive. 

The Examiner argues: "Therefore at the time the invention was made, it would have been 
obvious to one of ordinary skill in the art, to modify a system for access control address 
authentication of Sherer by using the counter and comparing the value of the counter with the 
threshold as taught in Stem and generating a spoofing alert as taught in Frantx. One of ordinary 
skill in the art would have been motivated to modify a system for access control address 
authentication by using the counter and comparing the value of the counts 

taught in Stern for issuing the authorization command (see Stem column 16, lines 39-40) and 
generate a spoofing alert as taught in Frantz for discarding the pack* (sec Frantz, Fig-S)" 

09/849,697 9 
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(emphasis added). 

In response, Applicant respectfully contend that the Examiner's suited modification 
of Sherer (i.e., "using the counter and comparing the value of the counter with the threshold ") 
does no more lhan provide alleged advantages to Sherer's invention which already exists in 
Sherer's invention without a counter. The advantages allegedly promoted by the modi fication of 
Sherer include ^generating a spoofing alert" and "discarding the packet". However, Shcrcr 
discloses in col. 6, lima 37-45: "If the MAC address is not authorized, then the packet h 
blocked, and the port is disabled or other action is taken to prevent that end station from 
accessing the layer two fabric of die network. Further, a notification message can be sent to a 
network management station, indicating that a failed authentication occurred" (emphasis 
added). Thus, Sherer does not have any use for the counter because Sherer already discloses 
(without need of a counter): blocking the packet and sending a notification message to a network 
management station. Therefore, modifying Sherer by adding a counter to Sherer's invention adds 
unnecessary complexity and unnecessary processing time to Shcrer's invention. 

In other words, the Examiner's suggested modification of Shcrer degrades the 
performance of Sherer's method without adding anyming of value to Sherer's method. 
Accordingly, Applicant respectfully contend that the Examiner has not established zprima facie 
case of obviousness in relation to claim 2. Therefore, claim 2 is not unpatentable over Shcrer in 
view of Stem and further in view of Frantz. 

Based on the preceding arguments, Applicants respectfully maintain that claim 2 is not 
unpatentable over Sherer in view of Stem and further in view of Frantz, and that claim 2 is in 

09/849,697 10 
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condition for allowance. Since claims 3-9 depend from claim 2, Applicants contend that claims 
3-9 are likewise in condition for allowance. 

in addition, Applicants respectfully traverse the Examiner's contention that "it is well 
known in tlie art of network administration to send the alert to a network administrator, for 
example Windows NT over TCP/IP system use administration alerts." Applicants respectfully 
request that the Examiner provide evidence that it is welt known to send a spoofmfj alert to a 
system administrator. 
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• CONCLUSION 

Based on the preceding arguments. Applicants respectfully believe that all pending claims 
and the entire application meet the acceptance criteria for allowance and therefore request 
favorable action. If the Examiner believes that anything further would be helpful to place the 
application in better condition for allowance, Applicants invites the Examiner to contact 
Applicants' representative at the telephone number listed below. The Director is hereby 
authorized to charge and/or credit Deposit Account 09-0457. 



Schmciser, Olscn & Watts 
3 Lear Jet Lane, Suite 201 
Latham, New York 121 10 
(518) 220-1850 



Jack P. Friedman 
Registration No. 44,688 
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